Vpn/Vps/Server

I am looking for a way to evade surveilance online. I know a librebooted thinkpad with no blobs and a gnu os is necessary for this but what do I do to change my ip? Is not being tracked without using a tunnel vpn like wireguard and purchasing a vps possible? Do I need to have a second librebooted laptop made into a server? Is monero necessary? I need help lainchan.

>>22653 Just use Tor with torbrowser-launcher package. >Is monero necessary? Yes because Bitcoin is even more public than your credit card.

>I know a librebooted thinkpad with no blobs and a gnu os is necessary No it is not. Unless you accidentally leaked the Epstein list, I doubt anyone would care enough about whatever you're doing to use a hardware backdoor. As for changing your IP, either rent some VPS in the middle of nowhere (Slovakia is a decent spot, to my knowledge. Take with a grain of salt) or just use Tor or something similar like I2P.

>>22658 How do I put that VPS to use? Do I have to buy one with moner?

>>22659 nta but found this one in another thread https://kycnot.me/

use tor instead of a vpn, if your thinkpad supports vt-d you could use qubes-whonix, if it doesn't you could still use whonix

>>22661 What do I do once I bought a vpn or vps?

>>22664 Just host a proxy on it. But keep in mind that most VPS providers will want to know who you are in order to rent a VPS from them. So pick one that doesn't collect that much data.>>22664

>>22664 https://landchad.net/wireguard/

counterpoint: there is nothing you can do to prevent being surveilled on 'a surveillance network', a literal war machine, (the internet) designed for the express purpose of surveillance. what you're essentially trying to do is put duct tape over your license plate and drive cross-country on the highway without getting stopped. you need to take a conceptual leap away from 'internet' and back to 'networks'. read tiqqun on cybernetics and switch over to gnunet.

Just use a VPN service that doesn't keep logs like mullvad or vpn.xxx >>22661 >What do I do once I bought a vpn or vps? just install the client software and run it. Just make sure you're not using your ISP's DNS server or something stupid, manually set DNS to 1.1.1.1 or 9.9.9.9 or literally anything else but your ISP. The problem to be addressed: All traffic coming from your router all share a public IP and you rent that IP from someone who owns it, namely your ISP. Think of your public IP as your house address. Then internal to your LAN/home network each device has it's own local IP like a room number. None of the public internet infrastructure knows or cares about your device's local IP. However, all traffic coming from your house shares your public IP and anyone can look up who owns that IP on the IANNA registry using RIPE/ARIN/etc (depending on region). The glowies see your IP is owned by verizon and just get a warrant/subpoena to see whose renting that IP, you. To avoid that tracking you use a VPN. Your traffic is in an encrypted tunnel from your house to the VPN provider, then your traffic routes to it's intended destination. When the feds look up who owns the IP your sus traffic is coming from they see the VPN provider, submit a warrant to see which client (ur public IP) the concerning traffic came from. But some providers like the two listed above keep zero logs of any connections or traffic. so the result of the subpoena is an empty connection log file 0 bytes long named "customer logs". So all the govt knows is someone made some sus connection from that VPN. If your govt wire taps all network traffic in your country they could see everyone using that VPN provider, but your traffic could have been ANY of the traffic going from that VPN to +10K residential addresses. Using VPS: You can rent a VPS from a cloud provider and host your own VPN to pivot your traffic through. The problem is it's a lot harder to find cloud providers that won't snitch on you and you don't get a crowd blending benefit against wire tapping. Also if the cloud provider got a subpoena they have FULL access to your VPS since they literally own the physical hypervisor running your instance, so they could give full unfettered access to the govt to just TCP dump all traffic you send through that cloud hosted VPN. The only way self hosting makes good sense is if you're hosting the VPN on hacked/stolen infrastructure.

>>22686 Every service that claims they don't keep logs, keeps logs. It is mandatory for them to operate. Anytime a major crime is investigated the "we don't keep logs" people are always passing on logs to investigating bodies.

>>22875 no mullvad were raided and police had to fuarrrkoff because no logs

>>22680 is gnunet worth it? looks like a loot of stuff to learn. can help lains get started? or do you just go down the rabbit hole and see how it goes? also, is it really worth it? i mean you still go through your ISP and you still have to trust peers and so on. what are real benefits of gnunet? i only see a point in f2f networks, but i don't have any friends who'd be interested.

>>22884 no it isnt. for some reason eveery loser on these boards thinks that something having "gnu" in its name makes it automatically good and solves all of societys problems. no one cares about gnunet so its not worth bothering with. you gain much more from learning how to protect yourself on the internet that people actually use

>>22884 it is >>22966 just updating gnunet is literally dead lol. its completely offline so even if you wanted to try it, you cant. somehow completely unsurprising that a "gnu" project is this big of a pile of dogshit

What if I don't really care about my ISP or big tech knowing what I do but malicious individuals with scummy intentions? Why is this topic never discussed? Why is there no VPN guide or suggested VPNs for safely browsing chans and forums which are the only places on the net where your security actually matters? >inb4: just use Tor I use Tor every time I can but not all imageboards allow posts from Tor. Lets face it: the only real threat to your well being (unless you're a criminal) is at individual level. The real threat is what malicious individuals want to do with your info. Don't use social media, don't share your private info with anyone and be as reclusive as possible those are things I do but I still face the issue of what VPN should I use when Tor isn't enough so when I access RetardChan, the IB with 4 posts a day the admin and mods are not going to gangstalk me? Not saying big tech and the government are to be trusted but their threat to me is nonexistent because I don't do anything illegal so I'm not facing legal prosecution. But what about doxxing? What about social engineering? Protecting yourself from big tech and feds is basic but there's also the added layer of individuals targeting you. And if you're like me and avoid social media and instant messages you're most likely subjected to forums/chans and what happens there: lots and lots of gangstalkers.

What does Lain think of Safing's SPN in Portmaster? Apparently they currently run all the servers but say when enough users it will be divided half them half users for each step to prevent same people winding up controlling all the end nodes by chance. It is claimed to be better than a VPN though not all the functions of Tor. Im not sure but it seems to have similar or the same network layout as Apple's iCloud Private Relay but open source. https://safing.io/spn/ >>24273 >gangstalking Every time I see this I just assume the person is having a paranoid delusion unless they are really good at making enemies with dedication and skills which is highly unlikely. Even major controversial e celebrities dont all get that attention and they are extremely easy to track down if anyone wanted to.

>>24276 Gangstalking is real and sometimes people just get unlucky or are unlikeable to the wrong people. Shity stuff, though I think most who are afraid of it are self important peoples with delusions of grandeur. >>24273 Just use multiple vpns.

>>24276 How would you know what icloud private relay looks like if its not open source?

>>24276 Safing's SPN in Portmaster, looks good on paper, will have to try it to say more. Its much closer to tor in description then icloud private relay (who really knows?) Tor being used to access clearnet websites, is basically just a proxy chain. An encrypted proxy chain, but everything is encrypted nowindays, so their once brag on clearnet is moot as of late. Where tor really thrives is it onion services + access to clearnet. None of tors competitors seem to offer streamlined easy to setup versions for both.

is there any pro/con to setting up a ssh tunnel to a vps and proxying all web browser through it instead of setting up vpn services?

>>26196 Unfortunately Safing's SPN can not handle torrents yet and probably can't handle IPFS. Mullvad and a few other vpns uses something they call multihop which I think might be the same thing too but im not sure. Tor is too slow for normal use so it makes sense to have something that only has two connections between end points. Also I dont think it would work like a proxy chain, a proxy chain you can trace back to someone but this you shouldn't be able to not directly anyway, at least in theory.

>>26196 Sorry I forgot to mention they themselves said that SPN is better than a VPN for privacy but not as good as Tor. I also forgot to mention IVPN worked with them and they also have what they call multihop so multihop is indeed the same thing just the more general term for this method.

>>26209 I do that on my home network. Pros: It's dead simple to setup and use Cons: ???

>>26209 My first guess would be just performance. from ssh(1) manual: ssh contains support for Virtual Private Network (VPN) tunnelling using the tun(4) network pseudo-device, allowing two networks to be joined securely. The sshd_config(5) configuration option PermitTunnel controls whether the server supports this, and at what level (layer 2 or 3 traffic). .... Since an SSH-based setup entails a fair amount of overhead, it may be more suited to temporary setups, such as for wireless VPNs. More permanent VPNs are better provided by tools such as ipsecctl(8) and isakmpd(8). There's also wireguard now (wg(4) on openbsd) which is even more lighter apparently. Anyways, a lot of people use ssh tunnels myself included so just monitor the performance for a while and see if it's too much overhead.

>>24276 Just seems like split tunneling per program. You could achieve this with a script and multiple vpns from a VPN provider. Or your own VPSs.

Why is it always a fvcking thinkpad?

>>22884 why are you afraid of learning?

>>22653 >libreboot >no blobs Unfortunately, Libreboot does have those where no FOSS workaround was found. What you want is Canoeboot. https://canoeboot.org/ I'd recommend a T440p, because that's the most powerful laptop supported. Alternatively, you should only go as old as T420/520, since those are the oldest types you can fit with a quadcore processor (their CPUs are socketed) and 16GB of memory. You simply need that much for an actual daily driver in my experience. The T420 also has the best keyboard imo. >>276892 >why is it always a fvcking thinkpad Same reason it's always Linux instead of BSD. Once a certain thing gains a critical mass of people using and supporting it, there's little reason to opt for anything else in its category. If you're going to use a 14 year old laptop to avoid modern factory backdoors, you might as well pick the one that's still getting BIOS updates and new replacement batteries.

>>27696 >If you're going to use a 14 year old laptop to avoid modern factory backdoors, you might as well pick the one that's still getting BIOS updates and new replacement batteries. That’s sort of dumb because as much as it may lack backdoors (I recently stopped myself from performing the mistake on this basis) , it also lacks the most modern up do date virus protection Cause exploits evolve overtime and are often catered to the latest models of physical configs of the puter Tell me if I’m wrong

>>27701 Antivirus compatibility depends on the operating system you can run on a given hardware configuration. Sticking with our 14 year old example: a T420 can still run Debian 13. With a quadcore and full memory config, you can even run Flatpaks and use the default GNOME desktop just fine if you disable the UI animations in accessibility settings. Debian 13 will get three more years of security updates, Debian 14, currently in testing, isn't dropping support for the amd64 instruction set either, because every 64 bit x86 processor uses it. On Debian, you can install Malwarebytes or whatever else you want, if you want it, although you'll have to tweak some settings because it comes with insecure defaults, like a disabled firewall. Code doesn't get safer as you write it. Statistically, writing new code will actually introduce new bugs and vulnerabilities from programming mistakes that don't get caught. Code gets safer the more it's audited, tested, or even just looked at. That's why binary blobs and closed source software in general are such a security liability in the first place: You can't look at the code and understand what might be wrong with it, and the companies writing the blobs would much rather sweep problems under the rug than pay programmers to go fix them. That's without even considering whether any three letter gonks actually want that backdoor in the system, but their work gets much more difficult without blobs to simply hide their point of access.

>>27696 Canoeboot is a useless project only made to appeal to the crazy FSF standards, the Librebooted thinkpads that don't get bricked when ran without proprietary software are shipped that way and librebooting the ones who don't still give you more freedom than with the standard BIOS.

>>27736 OP wants "no blobs", so it's the right thing to correct their misconception about Libreboot before they end up in jail due to evidence gleaned from the fact that it doesn't fully deactivate Intel Management Engine on (using the most common example) a T480. The FSF is pedantic as fuarrrk, but Intel had the bright idea to make a Rube Goldberg miniature operating system running a JAVA VIRTUAL MACHINE to decide if your CPU is going to start or not. This dependency runs so deep, instead of wiping it completely, ME """Cleaner""" only cuts IME down, lets it do its stupid thing during startup, and then puts it into an "inactive state", but it's unclear if that actually prevents an attacker from targeting exploits we can't know about because there still is blobby code running in the background. Everyone should be asking how Intel managed to fit so many vulnerabilities into such a small OS if they weren't asked to put them there, with obvious implications for anyone who can see that these surveillance crackdowns won't stop. By comparison, Canoeboot actually wipes IME. It lets you have a computer where everything is compiled from sourcecode people can look at and discuss freely. On the other hand, it really will brick anything newer than the TX40 series. I'm sorry if you tried to install it on an unsupported platform.

>>27704 >using a antivirus on a librebooted thinkpad running Linux What are people doing to require this >inb4 dodgy downloads / torrenting Errrrr just firejail that soykaf

>>27737 me_cleaner closely works with coreboot and they've always been the kings of reverse engineering, IME with me_cleaner only initializes the hardware then gets completely wiped out of everything with only the binary left for the next boot, it doesn't even get its way to GRUB. It's also a silly thing to focus over when all of the chips without (or where IME can get wiped which only applies for pre-2012 chips iirc) IME haven't gotten microcode updates in decades and are thus even exploitable by skids. Canoeboot is also far more poorly maintained than libreboot and Rowe often jokes around about its significance. IME is definitely scary but there are countless of ways that bad actors can get you which people here don't focus enough on. There aren't even any documented cases where IME is used so it can be interpreted as irrational. >I'm sorry if you tried to install it on an unsupported platform. Never tried canoe because I don't have any compatible devices but I do remember compiling libreboot for the first time to completely remove IME and spending countless hours trying to find why it's bricked kek >It lets you have a computer where everything is compiled from sourcecode people can look at and discuss freely. Rowe mentioned that it's completely impossible to have a PC functional with modern software that's 100% libre, I don't have her (please don't start an off-topic fight over the pronoun usage ITT) article at hand but SSDs and modern HDDs have a small OS running inside them and so do USB sticks, internet connection without proprietary software is also impossible.

>>27738 >What are people doing to require this Delilah asked about it. >>27739 >me_cleaner closely works with coreboot and they've always been the kings of reverse engineering, IME with me_cleaner only initializes the hardware then gets completely wiped out of everything with only the binary left for the next boot, it doesn't even get its way to GRUB Yes, realistically, it's proooooobably just as good as killing it completely from a security standpoint, but it's better to have it 100% gone if you're trying to be the next Assange. >It's also a silly thing to focus over when all of the chips without (or where IME can get wiped which only applies for pre-2012 chips iirc) IME haven't gotten microcode updates in decades and are thus even exploitable by skids. Idk, I've only heard about microcode exploits that require both a vulnerable processor and operating system, whereas IME has its own network access if you're the type who keeps their laptop plugged into ethernet at home. Please correct me if I'm wrong, because, when the T480 released, the T440p was half as old as the T480 now is, and at this point it looks like obsolete microcode is something we'll have to find a way to live with. >Rowe mentioned that it's completely impossible to have a PC functional with modern software that's 100% libre It used to be completely impossible to have an 100% libre operating system, but here we are, because people like her kept trying. >I don't have her article at hand but SSDs and modern HDDs have a small OS running inside them Yes, and it's unlikely that OpenSSD will expand out of the research space, but it's not impossible, and every blob less helps. >internet connection without proprietary software is also impossible Because BSDards keep giving corpos an easy way to dodge the GPL. Pic related.

>>22966 It probably has something to do with being marker for having a shared set of principles. Unfortunately this set of principles often seems to include the "I'll design the logo" mentality and the projects don't really go anywhere as a result >>26210 >tor is too slow for normal use I guess you probably haven't been on it for a few years, or keep getting a guard in a soykafhole with bad infrastructure. whenever I go on Tor it's usually as fast as using LTE with a VPN